[PATCH 1/3] ubifs: gc: fix authentication node leak

[PATCH 1/3] ubifs: gc: fix authentication node leak

[shao.mingyin]

move_nodes() allocates the authentication node, writes it to the GC
write-buffer and only frees it on the error paths.  Every GC pass that
moves nodes on an authenticated file system therefore leaks
ubifs_auth_node_sz() bytes.

Free the buffer after it has been written to the write-buffer.

Fixes: 6f06d96fdf62 ("ubifs: Add auth nodes to garbage collector journal head")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 933c79b5cd6b..2b0f29423f48 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -427,6 +427,7 @@ static int move_nodes(struct ubifs_info *c, struct ubifs_scan_leb *sleb)
 				kfree(auth);
 				goto out;
 			}
+			kfree(auth);
 
 			ubifs_add_dirt(c, wbuf->lnum, ubifs_auth_node_sz(c));
 		}

Re: [PATCH 1/3] ubifs: gc: fix authentication node leak

[Zhihao Cheng]

在 2026/11/2 19:50, shao.mingyin@zte.com.cn 写道:
> move_nodes() allocates the authentication node, writes it to the GC
> write-buffer and only frees it on the error paths.  Every GC pass that
> moves nodes on an authenticated file system therefore leaks
> ubifs_auth_node_sz() bytes.
> 
> Free the buffer after it has been written to the write-buffer.
> 
> Fixes: 6f06d96fdf62 ("ubifs: Add auth nodes to garbage collector journal head")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
> ---
> diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
> index 933c79b5cd6b..2b0f29423f48 100644
> --- a/fs/ubifs/gc.c
> +++ b/fs/ubifs/gc.c
> @@ -427,6 +427,7 @@ static int move_nodes(struct ubifs_info *c, struct ubifs_scan_leb *sleb)
>   				kfree(auth);
>   				goto out;
>   			}
> +			kfree(auth);
>   
>   			ubifs_add_dirt(c, wbuf->lnum, ubifs_auth_node_sz(c));
>   		}
> .
> 

[PATCH 0/3] ubifs: fix an auth node leak and two error-handling bugs

[shao.mingyin]

This series fixes three independent problems in ubifs, all found while
auditing the error paths around the GC write-buffer, xattr creation and
authenticated node hashing.

Patch 1 fixes a leak.  move_nodes() allocates the authentication node for
the GC journal head and writes it into the GC write-buffer; the buffer is
freed only when one of the steps fails.  On an authenticated file system
every GC pass that moves nodes therefore leaks ubifs_auth_node_sz()
bytes, so the loss is unbounded on a long-running system.

Patch 2 fixes state that survives a failed operation.  create_xattr()
sets UBIFS_CRYPT_FL for inodes that carry an encryption context, but its
error path clears the flag whether this call set it or not.  A setxattr()
that fails before anything reaches the journal, for example because its
journal buffer cannot be allocated, therefore leaves the in-memory inode
marked as unencrypted; the next inode write persists that, and after the
next mount the inode is no longer treated as encrypted although its names
and data still are.

Patch 3 stops five call sites from ignoring ubifs_node_calc_hash().  With
authentication enabled a failing crypto operation leaves those callers
using an uninitialised stack buffer as the node hash; it is then stored in
the TNC or in the master node, and the affected nodes fail verification
later.

The three patches are independent and can be applied in any order or as a
subset.  They are listed by severity, not by dependency: the leak first,
then the persistent state loss, then the error propagation.

All three carry Fixes: and Cc: stable.

Testing: the patches apply to next-20261030, pass checkpatch.pl --strict
with 0 errors/0 warnings/0 checks, and fs/ubifs/ builds with
CONFIG_UBIFS_FS_AUTHENTICATION, CONFIG_UBIFS_FS_XATTR and
CONFIG_UBIFS_FS_SECURITY enabled and W=1 without new warnings.  They were
not exercised at runtime: this machine has no UBI/MTD tooling or
emulation, so there is no mount test.  Patch 1 is the easiest to verify by
inspection; patch 2 needs an allocation or I/O failure in
ubifs_jnl_update(); patch 3 needs a crypto failure inside
ubifs_node_calc_hash().

Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c

[PATCH 1/3] ubifs: gc: fix authentication node leak

[shao.mingyin]

move_nodes() allocates the authentication node, writes it to the GC
write-buffer and only frees it on the error paths.  Every GC pass that
moves nodes on an authenticated file system therefore leaks
ubifs_auth_node_sz() bytes.

Free the buffer after it has been written to the write-buffer.

Fixes: 6f06d96fdf62 ("ubifs: Add auth nodes to garbage collector journal head")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 933c79b5cd6b..2b0f29423f48 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -427,6 +427,7 @@ static int move_nodes(struct ubifs_info *c, struct ubifs_scan_leb *sleb)
 				kfree(auth);
 				goto out;
 			}
+			kfree(auth);

 			ubifs_add_dirt(c, wbuf->lnum, ubifs_auth_node_sz(c));
 		}